Getting started

This guide walks you through a first SecureOPS deployment. By the end you will have log data flowing, detections enabled, and alerts arriving in the case queue.

Before you begin

You need:

• A SecureOPS tenant URL and administrator credentials (provided by the Netwatch team during onboarding).
• Network access from your log sources to the SecureOPS ingestion endpoint over TLS (port 443).
• Administrative access to the systems you want to onboard.

Step 1 — Sign in to SecureOPS

Open your tenant URL and sign in with your administrator account. The first login prompts you to set up multi-factor authentication — this is required for all SecureOPS users.

Step 2 — Deploy your first collector

Collectors gather logs from your environment and forward them securely to SecureOPS.

1. Go to Settings → Collectors → Add collector.
2. Choose the platform (Windows, Linux, or virtual appliance).
3. Copy the generated install command and run it on the target system.
4. The collector appears in the collector list within a minute, with status Connected.

See Log collection for source-specific guidance.

Step 3 — Connect a SaaS source

Cloud platforms are connected through API integrations rather than collectors. Start with Office 365 — sign-in activity and audit logs are among the highest-value security telemetry available.

Step 4 — Enable detections

1. Go to Detections → Rule packs.
2. Enable the rule packs matching your connected sources (for example Windows Security, Office 365, Firewall).
3. Rules begin evaluating incoming events immediately.

Step 5 — Review your first alerts

New alerts land in Cases → Alert queue, already triaged by the AI SOC analyst with a severity score and an investigation summary. Open one to see the full context: related events, affected assets, and recommended next steps.

Next steps

• Tune detection rules to your environment.
• Set up case management workflows for your team.
• Enable threat intelligence enrichment.